The FreeType Project - Bugs: bug #46255, Malformed Type42 font takes a long...
You are not allowed to post comments on this tracker with your current authentication level.
bug #46255: Malformed Type42 font takes a long time to parse.
Submitter: | bungeman <bungeman> | ||
Submitted: | Mon 19 Oct 2015 10:26:04 PM UTC | ||
Severity: | 3 - Normal | Item Group: | Incorrect behaviour |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.6.2 |
Wed 21 Oct 2015 05:03:29 AM UTC, comment #4: |
Werner LEMBERG <wl> |
Tue 20 Oct 2015 07:56:30 PM UTC, comment #3: I've locally applied the attached 'type42.diff' to my source to work around this. This applies the same "(FT_Long)( limit - parser->root.cursor ) < face->ttf_size" check done in the BEFORE_START case to the BEFORE_TABLE_DIR case. |
bungeman <bungeman> |
Tue 20 Oct 2015 05:59:47 PM UTC, comment #2: In this case there is one single huge allocation which happens in t42_parse_sfnts on the lines like
|
bungeman <bungeman> |
Tue 20 Oct 2015 03:14:10 PM UTC, comment #1: I ran this with an un-instrumented build of FreeType/runonce doing something like
|
bungeman <bungeman> |
Mon 19 Oct 2015 10:26:04 PM UTC, original submission:
Found with libFuzzer with FreeType 5179c89f61aa6b, reproduction attached.
|
bungeman <bungeman> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-10-21 | wl | Item Group | Wishlist | Incorrect behaviour | |
Status | None | Fixed | |||
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.6.2 | |||
2015-10-20 | bungeman | Attached File | - | Added type42.diff, #35245 | |
2015-10-19 | bungeman | Attached File | - | Added 6efffbcd9e11318b86881506a4b0d2c7b0f489a9, #35234 |
Powered by Savane 3.13-02a9.
Corresponding source code
Thanks for the report and patch; I've fixed it slightly differently in the git.